Passkey/FIDO2 API error reference
This document lists common error codes, descriptions, and recommended resolutions for Passkey/FIDO2 registration and authentication flows using IDaaS.
IDaaS API error codes
| Error Code | Description | Resolution | HTTP Status |
|---|---|---|---|
max_fido_tokens | Maximum FIDO tokens reached | Check the number of passkeys for the user. | 400 |
fido_register_no_challenge | No challenge found on server for registration | Retry the registration process. | 400 |
fido_token_invalid_name | Invalid passkey token name | Ensure passkey name is in correct format and within length limits. | 400 |
fido_token_invalid_name_html | Invalid passkey token name (contains HTML) | Remove HTML content from passkey name. | 400 |
fido_token_duplicate_name | Duplicate passkey name | Provide a unique passkey name. | 400 |
fido_no_origin | No origin found in the registration request's clientDataJSON | Ensure the clientDataJSON contains a valid origin field. | 400 |
fido_rpid_not_allowed | RPID in the request is not allowed | RPID should match the one the passkey is associated with. | 401 |
fido_android_origin_not_allowed | Android origin is not allowed for the requested RPID | Ensure the Android app's SHA-256 certificate fingerprint is configured in the RPID allowlist for the matching relying party ID. | 400 |
fido_multiple_rpid_match | Android origin matches multiple RPIDs in the allowlist | Include the rpId request parameter to explicitly specify the intended relying party ID. | 400 |
fido_invalid_registration_response | Invalid registration data | Verify the registration input data. | 400 |
fido_direct_attestation_required | Direct attestation is required but the authenticator provided no attestation statement. Synced passkeys (for example, Google Password Manager, Apple Passwords) do not support attestation. | Use a hardware-bound authenticator that supports direct attestation, or change the attestation setting to INDIRECT or NONE. | 400 |
fido_attestation_cert_chain_required | Direct attestation was provided but the certificate chain (x5c) is missing | Use an authenticator that provides a full certificate chain during direct attestation. | 400 |
fido_authenticator_model_not_allowed | The authenticator's AAGUID is blocked or not on the allow list | Review the authenticator trust mode and the allowed/blocked authenticator list in Passkey/FIDO2 settings. | 400 |
fido_backup_eligible_registration_not_allowed | The authenticator is a synced passkey but the Device-Bound Only policy blocks synced passkeys from registering | Disable Device-Bound Only in Passkey/FIDO2 settings, or use a device-bound authenticator. | 400 |
fido_unknown_authenticator_model_blocked | The authenticator's AAGUID was not found in the FIDO MDS and the unknown-authenticator policy is set to BLOCK | Change the unknown authenticator policy to ALLOW in settings, or use a recognized authenticator model. | 400 |
fido_registration_server_error | An internal server error occurred during passkey registration | Retry the registration. If the problem persists, contact your system administrator | 500 |
fido_backup_eligible_not_allowed | The token is a synced passkey but the Device-Bound Only policy is enabled | Disable Device-Bound Only in Passkey/FIDO2 settings, or re-register with a device-bound authenticator. | 401 |
fido_multiple_metadata_statements | Multiple FIDO MDS metadata statements found for the same AAGUID | Contact support: the FIDO Metadata Service (MDS) contains duplicate entries for this authenticator's AAGUID | 400 |
fido_none_active | No passkey token registered/active | User must have an active passkey before initiating authentication. | 403 |
fido_no_challenge | No challenge found for passkey authentication | Initiate authentication with challenge first | 400 |
fido_invalid_authentication_response | No fidoResponse parameter found in the request | Ensure fidoResponse parameter is not null. | 400 |
fido_invalid_origin_param | Request parameter 'origin' is invalid | origin parameter should be in valid format. for example, https://example.com | 400 |
fido_different_origin_rpid_request_param_not_allowed | Request parameters 'origin' and 'rpId' both can not be different | Check Request parameters are same in Authenticate Challenge API request. | 400 |